1 files changed, 86 insertions, 0 deletions
diff --git a/opt/geoip/geoip_update.sh b/opt/geoip/geoip_update.sh
new file mode 100644
index 0000000..a7db14f
--- /dev/null
+++ b/opt/geoip/geoip_update.sh
@@ -0,0 +1,86 @@
+#!/bin/bash
+# Download legacy GeoIP databases from https://mailfud.org/geoip-legacy/
+# Deploy to /etc/cron.weekly/geoip_update (no .sh extension)
+
+DBDIR=/usr/share/GeoIP
+FILES="GeoIP GeoIPv6 GeoIPCity GeoIPCityv6 GeoIPASNum GeoIPASNumv6"
+
+# If http proxy needed, uncomment:
+#export https_proxy="http://foo.bar:3128"
+
+# Uncomment to enable iptables xt_geoip updating (requires xtables-addons):
+#XTABLES="GeoIP-legacy.csv"
+#XT_GEOIP_BUILD=/usr/lib/xtables-addons/xt_geoip_build
+
+test -w "$DBDIR" && cd "$DBDIR" 2>/dev/null || { echo "Invalid directory: $DBDIR"; exit 1; }
+
+# Stagger start when run from cron
+[ ! -t 0 ] && sleep $((RANDOM / 54))
+
+[ -n "$XTABLES" ] && FILES="$FILES $XTABLES"
+
+for f in $FILES; do
+	f=${f%.gz}
+	[[ ! "$f" =~ \.csv ]] && f=${f%.dat}.dat
+
+	curl -sSf --max-time 30 -o "$f.gz" "https://mailfud.org/geoip-legacy/$f.gz"
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		printf 'curl failed for %s: exit %s\n' "$f.gz" "$ret" >&2
+		continue
+	fi
+
+	if gzip -dc "$f.gz" > "$f.tmp"; then
+		# Handle first-run where $f may not exist yet
+		if [ ! -f "$f" ] || ! diff -q "$f" "$f.tmp" >/dev/null 2>&1; then
+			[ "$f" = "$XTABLES" ] && XUPD=1
+			printf 'updating %s\n' "$f"
+			chmod 644 "$f.tmp"
+			mv -f "$f.tmp" "$f"
+		else
+			printf '%s is up to date\n' "$f"
+		fi
+	else
+		printf 'gunzip failed for %s\n' "$f" >&2
+	fi
+	rm -f "$f.tmp" "$f.gz"
+done
+
+[ -z "$XTABLES" ] && exit 0
+
+if [ -z "$XT_GEOIP_BUILD" ]; then
+	if [ -f /usr/lib/xtables-addons/xt_geoip_build ]; then
+		XT_GEOIP_BUILD=/usr/lib/xtables-addons/xt_geoip_build
+	elif [ -f /usr/libexec/xtables-addons/xt_geoip_build ]; then
+		XT_GEOIP_BUILD=/usr/libexec/xtables-addons/xt_geoip_build
+	else
+		echo "xt_geoip_build not found; xtables-addons not installed?" >&2
+		exit 1
+	fi
+fi
+
+[ ! -f "GeoIP-legacy.csv" ] && {
+	echo "GeoIP-legacy.csv not found, cannot update xt_geoip" >&2
+	exit 1
+}
+
+if [ -n "$XUPD" ] || [ -z "$(find /usr/share/xt_geoip -name 'US.*' -mtime -14 2>/dev/null)" ]; then
+	mkdir -m 755 -p /usr/share/xt_geoip
+	if grep -q dbip-country-lite "$XT_GEOIP_BUILD"; then
+		tr -d '"' < "$DBDIR/GeoIP-legacy.csv" | cut -d, -f1,2,5 > "$DBDIR/dbip-country-lite.csv.tmp" &&
+			mv -f "$DBDIR/dbip-country-lite.csv.tmp" "$DBDIR/dbip-country-lite.csv"
+		XCMD="perl $XT_GEOIP_BUILD -D /usr/share/xt_geoip -S $DBDIR"
+	else
+		XCMD="perl $XT_GEOIP_BUILD -D /usr/share/xt_geoip $DBDIR/GeoIP-legacy.csv"
+	fi
+	ret=$($XCMD 2>/dev/null | tail -1)
+	if [[ "$ret" =~ (Zimbabwe|ZW) ]]; then
+		echo "xt_geoip updated"
+	else
+		echo "xt_geoip update failed" >&2
+		printf 'try manually: %s\n' "$XCMD" >&2
+		echo "perl module Text::CSV_XS required" >&2
+	fi
+else
+	echo "xt_geoip is up to date"
+fi